loki-mode 11.17.37 → 11.17.39

package/packages/control-plane/dist/server.js

@@ -146,7 +146,9 @@ var init_redact = __esm(() => {
     [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[REDACTED:JWT]"],
     [/AI[a-zA-Z0-9_-]{30,}/g, "[REDACTED:GOOGLE_KEY]"],
     [/sk-[A-Za-z0-9_-]{20,}/g, "[REDACTED:OPENAI_KEY]"],
-    [/(Bearer\s+)[A-Za-z0-9._~+/=-]{20,}/g, "$1[REDACTED]"]
+    [/(Bearer\s+)[A-Za-z0-9._~+/=-]{20,}/g, "$1[REDACTED]"],
+    [/(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/?#@]+@/gi, "$1[REDACTED]@"],
+    [/(\bAuthorization\s*[:=]\s*)(?:Basic|Bearer|Token|Digest)?\s*[^\s,;"']+/gi, "$1[REDACTED]"]
   ];
 });
 
@@ -7795,9 +7797,7 @@ function readJson3(path, isValid = (_v) => true) {
 function isRepoMap(v) {
   return typeof v === "object" && v !== null && Array.isArray(v.files) && Array.isArray(v.entries);
 }
-function readRepoMapCache(dir, tree) {
-  return readJson3(resolve8(dir, `repomap2-${tree}.json`), isRepoMap);
-}
+var readRepoMapCache = (dir, tree) => readJson3(resolve8(dir, `repomap2-${tree}.json`), isRepoMap);
 var init_cache = __esm(() => {
   init_paths();
 });
@@ -9791,8 +9791,8 @@ var init_testmap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/check_result.ts
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync29, renameSync as renameSync8, writeFileSync as writeFileSync16 } from "fs";
-import { basename as basename11, join as join38 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync13, readFileSync as readFileSync29, realpathSync as realpathSync17, renameSync as renameSync8, writeFileSync as writeFileSync16 } from "fs";
+import { basename as basename11, isAbsolute as isAbsolute3, join as join38 } from "path";
 function plainTestEnv(base = process.env) {
   const e = {};
   for (const [k, v] of Object.entries(tokenFreeEnv(base)))
@@ -10006,6 +10006,8 @@ function checkProvenance(name, ctx) {
       return "independent";
     if (ctx.addedFiles.some((a) => normPath(a) === p))
       return "agent_authored";
+    if (ctx.modifiedFiles?.some((m) => normPath(m) === p))
+      return "agent_authored";
   }
   return "exogenous";
 }
@@ -10161,6 +10163,92 @@ function failureExcerpt(out2, repoDir = "", cap = EXCERPT_GROUP_CAP) {
   body = redactSecrets(body);
   return truncateBytes(body, cap);
 }
+function pytestCollectionIsRed(output, repoDir) {
+  if (/ModuleNotFoundError/.test(output))
+    return false;
+  const real2 = (p) => {
+    try {
+      return realpathSync17(isAbsolute3(p) ? p : join38(repoDir, p));
+    } catch {
+      return null;
+    }
+  };
+  const repoReal = real2(repoDir);
+  const under = (p) => {
+    const r = real2(p);
+    return !!repoReal && !!r && (r === repoReal || r.startsWith(`${repoReal}/`));
+  };
+  const imp = /ImportError: cannot import name .* from ['"][\w.]+['"] \(([^)]+)\)/.exec(output);
+  if (imp)
+    return under(imp[1]);
+  const hdr = [...output.matchAll(/^=+ short test summary info =+$/gm)].pop();
+  if (!hdr)
+    return false;
+  const cls = [...output.slice(hdr.index).matchAll(/^ERROR \S+ - (\w+Error): /gm)].pop()?.[1];
+  if (cls !== "AttributeError" && cls !== "NameError")
+    return false;
+  const start = output.search(/^_+ ERROR collecting /m);
+  if (start < 0 || start > hdr.index)
+    return false;
+  const block = output.slice(start, hdr.index).split(/^-+ Captured .*$/m)[0];
+  const eLines = [...block.matchAll(new RegExp(`^E {3}${cls}: (.*)$`, "gm"))];
+  const eLine = eLines[eLines.length - 1];
+  if (!eLine)
+    return false;
+  if (cls === "AttributeError") {
+    const m = /^module ['"]([\w.]+)['"] has no attribute/.exec(eLine[1]);
+    return !!m && moduleUnderRepo(repoDir, m[1]);
+  }
+  const frames = [...block.slice(0, eLine.index).matchAll(/^(.+?):\d+: in \S+\n\s*(.*)$/gm)];
+  const last = frames[frames.length - 1];
+  return !!last && under(last[1]) && !/^\s*(import\s|from\s\S+\s+import\b)/.test(last[2] ?? "");
+}
+function moduleUnderRepo(repoDir, name) {
+  const rel = name.replace(/\./g, "/");
+  return existsSync23(join38(repoDir, `${rel}.py`)) || existsSync23(join38(repoDir, rel, "__init__.py"));
+}
+function pytestExit1IsRed(output) {
+  if (/^!+ _pytest\.outcomes\.Exit\b/m.test(output))
+    return false;
+  if (/^=*\s*(\d+ \w+(, )?)*\d+ failed\b.* in [\d.]+s/.test(output.trimEnd().split(`
+`).pop() ?? ""))
+    return true;
+  const hdr = [...output.matchAll(/^=+ short test summary info =+$/gm)].pop();
+  return !!hdr && /^FAILED \S+/m.test(output.slice(hdr.index));
+}
+function parsedFailCount(runner, output) {
+  const m = runner === "bun" ? /^\s*(\d+)\s+fail\s*$/m.exec(output) : runner === "jest" ? /Tests:\s*(\d+)\s+failed/i.exec(output) : runner === "vitest" ? /Tests\s+(\d+)\s+failed/i.exec(output) : null;
+  return m ? Number(m[1]) : 0;
+}
+function nodeIsRed(f, raw2) {
+  const o = raw2.replace(/^# (?!(?:tests|suites|pass|fail|cancelled|skipped|todo|duration_ms|Subtest)\b)/gm, "");
+  const mod = /^Error(?: \[\w+\])?: Cannot find (?:module|package) '([^']+)'(?:(?!\u2716)[\s\S])*?\nNode\.js v/m.exec(o), top = /^(\S+):\d+\n.*\n.*\n\n?(?:ReferenceError|SyntaxError)\b/m.exec(o);
+  const named = [...o.matchAll(/^(?:\u2716|\s*not ok \d+ -) (?!failing tests:)(.+?)(?: \(|$)/gm)].some((m) => !f.path.endsWith(m[1]) && !m[1].endsWith(f.path)), blk = o.split("failing tests:")[1] ?? "", esm = /^SyntaxError: The requested module '([^']+)' does not provide an export named/m.exec(o), errs = [...blk.matchAll(/^ {2}(\w+Error): .*\n\s+at (?:.*\()?([^\s()]+?):\d+:\d+/gm), ...o.matchAll(/^ +name: '(\w+Error)'\n(?:.*\n)*? +stack: \|-\n\s+(?:.*\()?([^\s()]+?):\d+:\d+/gm)];
+  return /^(?:#|\u2139) fail [1-9]/m.test(raw2) && (/^ {2}AssertionError\b/m.test(blk) || /^ +name: 'AssertionError'/m.test(o) || (mod && !named ? /^[./]/.test(mod[1]) : esm ? /^[./]/.test(esm[1]) : top ? !top[1].endsWith(f.path) : !errs.length || errs.some((e) => !/^(?:Reference|Syntax)Error$/.test(e[1]) || !(e[2].startsWith("node:") || e[2].endsWith(f.path)))));
+}
+function notRunReason(status, interpreter) {
+  if (interpreter === "system")
+    return "ran under the system interpreter, not the project's, so the result proves nothing";
+  if (status === null)
+    return "the test runner did not start or timed out";
+  if (status === 126 || status === 127)
+    return `the test runner command was not found or not executable (exit ${status})`;
+  return status === 0 ? "exit 0 but no executed test count could be confirmed" : `exit ${status} but the runner output showed no readable failing test`;
+}
+function classify(f, status, output, repoDir, interpreter) {
+  if (interpreter === "system")
+    return "not_run";
+  output = stripAnsi(output);
+  if (status === null || status === 126 || status === 127)
+    return "not_run";
+  if (status === 0)
+    return classifyCheck({ kind: "test", ok: true, out: output, path: f.path, ...f.runner === "go" ? { runner: "go" } : {} }).result === "pass" ? "pass" : "not_run";
+  if (f.runner === "pytest")
+    return status === 1 ? pytestExit1IsRed(output) ? "fail" : "not_run" : status === 2 ? pytestCollectionIsRed(output, repoDir) ? "fail" : "not_run" : "not_run";
+  if (f.runner === "jest" || f.runner === "vitest" || f.runner === "bun")
+    return parsedFailCount(f.runner, output) > 0 ? "fail" : "not_run";
+  return f.runner === "node" && nodeIsRed(f, output) ? "fail" : "not_run";
+}
 var NO_TESTS_REASON = "no tests executed", GO_EXIT0_REASON = "test count could not be confirmed: go test output is produced by the code under test and cannot confirm execution (a Go exit 0 is never a pass)", UNCONFIRMED_REASON = "test count could not be confirmed", FAIL_EVIDENCE, GO_FAIL_EVIDENCE, UNMEASURED_REASON = "executed count unmeasured (Loki could not parse the runner summary, harness-owned)", stripAnsi = (s) => s.replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "").replace(/(?:\u001b\[|\u009b)[0-9;?]*[ -\/]*[@-~]/g, "").replace(/\r\n?/g, `
 `), tailLines = (out2) => out2.split(`
 `).filter((x) => x.trim()).slice(-12), GO_PKG_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), EXCERPT_GROUP_CAP = 1500, EXCERPT_TOTAL_CAP = 6144;
@@ -10213,8 +10301,8 @@ var init_state = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/repo_profile.ts
-import { existsSync as existsSync23, readFileSync as readFileSync30, mkdirSync as mkdirSync14, readdirSync as readdirSync14, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
-import { basename as basename12, join as join39, resolve as resolve13, isAbsolute as isAbsolute3 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync30, mkdirSync as mkdirSync14, readdirSync as readdirSync14, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
+import { basename as basename12, join as join39, resolve as resolve13, isAbsolute as isAbsolute4 } from "path";
 function loadProfile(repoDir) {
   try {
     const p = JSON.parse(readFileSync30(commandProfilePath(repoDir), "utf8"));
@@ -10350,7 +10438,7 @@ var init_context = __esm(() => {
 });
 
 // ../../loki-ts/src/util/steer.ts
-import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync15, lstatSync as lstatSync9, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync31, readSync as readSync7, renameSync as renameSync10, statSync as statSync15, lutimesSync, rmSync as rmSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync18, existsSync as existsSync24 } from "fs";
+import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync15, lstatSync as lstatSync9, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync31, readSync as readSync7, renameSync as renameSync10, statSync as statSync15, lutimesSync, rmSync as rmSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync18, existsSync as existsSync25 } from "fs";
 import { createHash as createHash9, randomBytes as randomBytes4 } from "crypto";
 import { basename as basename13, join as join40 } from "path";
 function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
@@ -10387,7 +10475,7 @@ function orphanAlreadyArchived(logs, claim) {
       const s = statSync15(join40(logs, a));
       if (s.ino !== c.ino || s.dev !== c.dev)
         continue;
-      if (/^human-input-(ORPHAN|REJECTED)-/.test(a) || existsSync24(appliedMarker(logs, a)))
+      if (/^human-input-(ORPHAN|REJECTED)-/.test(a) || existsSync25(appliedMarker(logs, a)))
         return true;
     } catch {}
   }
@@ -10689,12 +10777,12 @@ var init_seal_drift = __esm(() => {
 });
 
 // ../../loki-ts/src/util/spec_file.ts
-import { isAbsolute as isAbsolute4, join as join41, relative as relative2 } from "path";
+import { isAbsolute as isAbsolute5, join as join41, relative as relative2 } from "path";
 function specReceiptBlock(env) {
   const { LOKI_E10_SPEC_PATH: p, LOKI_E10_SPEC_SHA256: sha2 } = env;
   if (!p || !sha2)
     return {};
-  const rel = isAbsolute4(p) && env.LOKI_E10_REPO_DIR ? relative2(env.LOKI_E10_REPO_DIR, p) : p;
+  const rel = isAbsolute5(p) && env.LOKI_E10_REPO_DIR ? relative2(env.LOKI_E10_REPO_DIR, p) : p;
   return { spec: { path: rel, sha256: sha2 } };
 }
 var SPEC_DIR;
@@ -10720,11 +10808,11 @@ var init_run_cap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/mutation_proof.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync32, rmSync as rmSync10, symlinkSync, writeFileSync as writeFileSync19 } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync32, rmSync as rmSync10, symlinkSync, writeFileSync as writeFileSync19 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { basename as basename14, dirname as dirname13, isAbsolute as isAbsolute5, join as join42, relative as relative3 } from "path";
+import { basename as basename14, dirname as dirname13, isAbsolute as isAbsolute6, join as join42, relative as relative3 } from "path";
 function mutationProof(i) {
-  const rels = i.wallFiles.map((f) => isAbsolute5(f.path) ? relative3(i.repoDir, f.path) : f.path);
+  const rels = i.wallFiles.map((f) => isAbsolute6(f.path) ? relative3(i.repoDir, f.path) : f.path);
   if (rels.length === 0)
     return np("no Wall tests");
   const tests = rels.flatMap((rel) => {
@@ -10743,12 +10831,12 @@ function mutationProof(i) {
     parent = mkdtempSync3(join42(tmpdir4(), "loki-mutproof-"));
     wt = join42(parent, "wt");
     const add3 = git(i.repoDir, ["worktree", "add", "--detach", wt, i.baseSha], Math.max(1000, Math.min(30000, remaining())));
-    added = existsSync25(wt) || add3.status === 0;
+    added = existsSync26(wt) || add3.status === 0;
     if (add3.status !== 0)
       return np("could not create the base worktree");
     for (const rel of rels) {
-      const sealed = join42(i.runDir, "wall", basename14(rel)), src = existsSync25(sealed) ? sealed : join42(i.repoDir, rel);
-      if (!existsSync25(src))
+      const sealed = join42(i.runDir, "wall", basename14(rel)), src = existsSync26(sealed) ? sealed : join42(i.repoDir, rel);
+      if (!existsSync26(src))
         return np(`Wall file missing: ${rel}`);
       mkdirSync16(dirname13(join42(wt, rel)), { recursive: true });
       writeFileSync19(join42(wt, rel), readFileSync32(src));
@@ -10759,7 +10847,7 @@ function mutationProof(i) {
         const anc = parts.slice(0, n2).join("/");
         for (const d of DEP_DIRS) {
           const src = join42(i.repoDir, anc, d), dst = join42(wt, anc, d);
-          if (existsSync25(src) && !existsSync25(dst)) {
+          if (existsSync26(src) && !existsSync26(dst)) {
             try {
               symlinkSync(src, dst);
             } catch {}
@@ -10902,14 +10990,14 @@ var init_shell = __esm(() => {
 });
 
 // ../../loki-ts/src/util/python.ts
-import { accessSync, constants as constants3, existsSync as existsSync26, mkdtempSync as mkdtempSync4, readFileSync as readFileSync33, realpathSync as realpathSync17, rmSync as rmSync11, statSync as statSync16 } from "fs";
+import { accessSync, constants as constants3, existsSync as existsSync27, mkdtempSync as mkdtempSync4, readFileSync as readFileSync33, realpathSync as realpathSync18, rmSync as rmSync11, statSync as statSync16 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
 async function findPython3() {
   if (_pythonCache !== undefined)
     return _pythonCache;
   const homebrew = "/opt/homebrew/bin/python3.12";
-  if (existsSync26(homebrew)) {
+  if (existsSync27(homebrew)) {
     _pythonCache = homebrew;
     return homebrew;
   }
@@ -11352,7 +11440,7 @@ Example: test('name', () => { assert.strictEqual(fn(1), 2); });  Run: node --tes
 
 // ../../loki-ts/src/util/holdout.ts
 import { createHash as createHash12 } from "crypto";
-import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync27, mkdirSync as mkdirSync17, readFileSync as readFileSync34, rmSync as rmSync12, writeFileSync as writeFileSync20 } from "fs";
+import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync34, rmSync as rmSync12, writeFileSync as writeFileSync20 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
 import { basename as basename16, join as join43, relative as relative4 } from "path";
 function wallHoldoutRatio(env = process.env) {
@@ -11403,7 +11491,7 @@ function stageHoldout(dir, repoDir) {
   mkdirSync17(man.targetDir, { recursive: true });
   man.files.forEach((f, i) => {
     const src = join43(dir, f.name);
-    if (!existsSync27(src) || sha2(readFileSync34(src, "utf8")) !== f.sha256) {
+    if (!existsSync28(src) || sha2(readFileSync34(src, "utf8")) !== f.sha256) {
       missing.push(`holdout ${i + 1} missing or altered`);
       return;
     }
@@ -12077,7 +12165,7 @@ var init_runner_errors = __esm(() => {
 
 // ../../loki-ts/src/runner/load_owner.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { mkdtempSync as mkdtempSync6, realpathSync as realpathSync18, rmSync as rmSync14 } from "fs";
+import { mkdtempSync as mkdtempSync6, realpathSync as realpathSync19, rmSync as rmSync14 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
 import { basename as basename18, extname as extname2, join as join46 } from "path";
 function changedFilesNamed(out2, repoDir, changed) {
@@ -12099,7 +12187,7 @@ function loadSignature(out2, roots) {
   let o = out2;
   for (const r of roots.flatMap((x) => {
     try {
-      return [x, realpathSync18(x)];
+      return [x, realpathSync19(x)];
     } catch {
       return [x];
     }
@@ -12225,7 +12313,7 @@ var init_load_owner = __esm(() => {
 });
 
 // ../../loki-ts/src/util/wall_owned.ts
-import { isAbsolute as isAbsolute6, join as join47, relative as relative5 } from "path";
+import { isAbsolute as isAbsolute7, join as join47, relative as relative5 } from "path";
 function failingLocations(raw2, cwd, repoDir) {
   const out2 = raw2.replace(ANSI2, "").replace(/\r\n?/g, `
 `), files = new Set;
@@ -12257,7 +12345,7 @@ function failingLocations(raw2, cwd, repoDir) {
   }
   if (errors2 === 0 || located !== errors2)
     return null;
-  return [...files].map((f) => relative5(repoDir, isAbsolute6(f) ? f : join47(cwd, f)));
+  return [...files].map((f) => relative5(repoDir, isAbsolute7(f) ? f : join47(cwd, f)));
 }
 function wallOwnedFailure(raw2, cwd, repoDir, wall) {
   const locs = failingLocations(raw2, cwd, repoDir);
@@ -12270,7 +12358,7 @@ var init_wall_owned = __esm(() => {
 
 // ../../loki-ts/src/util/app_probe.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync28, mkdirSync as mkdirSync18, readFileSync as readFileSync37, renameSync as renameSync11, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync37, renameSync as renameSync11, writeFileSync as writeFileSync21 } from "fs";
 import { join as join48 } from "path";
 function readJson4(p) {
   try {
@@ -12282,7 +12370,7 @@ function readJson4(p) {
 }
 function stopApp(repoDir, opts = {}) {
   const runner = opts.runnerPath ?? join48(REPO_ROOT, "autonomy", "app-runner.sh");
-  if (!existsSync28(runner) || !existsSync28(join48(repoDir, ".loki", "app-runner", "app.pid")))
+  if (!existsSync29(runner) || !existsSync29(join48(repoDir, ".loki", "app-runner", "app.pid")))
     return;
   spawnSync4("bash", ["-c", STOP, "app-probe", repoDir, runner], { cwd: repoDir, env: plainTestEnv(), timeout: opts.timeoutMs ?? 60000, killSignal: "SIGKILL", stdio: "ignore" });
 }
@@ -12296,7 +12384,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
     return { out: r.stdout ?? "", status: r.error ? null : r.status };
   };
   let pid = null, url = null;
-  if (!existsSync28(runner))
+  if (!existsSync29(runner))
     return { checks: [mk2("app boot", "not_run", "app-runner.sh not found"), mk2("http probe", "not_run", "app not booted")], pid, url };
   try {
     const b = sh(BOOT);
@@ -12306,7 +12394,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     const ir = Number(m[1]), sr = Number(m[2]), hr = Number(m[3]);
-    const pidTxt = existsSync28(join48(dir, "app.pid")) ? readFileSync37(join48(dir, "app.pid"), "utf8").trim() : "";
+    const pidTxt = existsSync29(join48(dir, "app.pid")) ? readFileSync37(join48(dir, "app.pid"), "utf8").trim() : "";
     pid = /^\d+$/.test(pidTxt) && sr >= 0 ? Number(pidTxt) : null;
     const st = readJson4(join48(dir, "state.json"));
     url = typeof st?.["url"] === "string" ? st["url"] : null;
@@ -12333,7 +12421,7 @@ async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
   const t0 = Date.now();
   const res = (result, reason) => ({ name: "functional verify", cmd: "autonomy/lib/functional-verify.py", result, duration_s: (Date.now() - t0) / 1000, reason });
   const py = await findPython3(), script = opts.verifyPath ?? join48(REPO_ROOT, "autonomy", "lib", "functional-verify.py");
-  if (!py || !existsSync28(script))
+  if (!py || !existsSync29(script))
     return res("not_run", "python3 or functional-verify.py unavailable");
   const specFile = join48(dir, "spec.txt");
   writeFileSync21(specFile, opts.specText ?? "");
@@ -12381,14 +12469,15 @@ app_runner_stop >/dev/null 2>&1
 });
 
 // ../../loki-ts/src/util/secure_scan.ts
-import { existsSync as existsSync29 } from "fs";
-import { join as join49 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, mkdtempSync as mkdtempSync7, readFileSync as readFileSync38, realpathSync as realpathSync20, rmSync as rmSync15, statSync as statSync17, writeFileSync as writeFileSync22 } from "fs";
+import { tmpdir as tmpdir9 } from "os";
+import { dirname as dirname16, join as join49, resolve as resolve14, sep as sep11 } from "path";
 function fail(error) {
   return { ok: false, findings: [], error };
 }
 async function runSecureScan(targetDir, opts = {}) {
   const script = opts.scriptPath ?? join49(REPO_ROOT, "autonomy", "lib", "secure-scan.py");
-  if (!existsSync29(script))
+  if (!existsSync30(script))
     return fail(`secure-scan script not found: ${script}`);
   const py = await findPython3();
   if (!py)
@@ -12406,9 +12495,15 @@ async function runSecureScan(targetDir, opts = {}) {
   const obj = parsed && typeof parsed === "object" ? parsed : undefined;
   if ((res.exitCode === 0 || res.exitCode === 1) && obj && Array.isArray(obj.findings)) {
     const findings = obj.findings;
-    if (res.exitCode === 1 === findings.length > 0)
+    if (res.exitCode === 1 !== findings.length > 0)
+      return fail(`secure-scan exit ${res.exitCode} disagrees with ${findings.length} findings`);
+    if (opts.secretsEverywhere || opts.diffBase === false)
       return { ok: true, findings };
-    return fail(`secure-scan exit ${res.exitCode} disagrees with ${findings.length} findings`);
+    const added = await scanAddedLines(targetDir, { ...opts, scriptPath: script, timeoutMs });
+    if (!added.ok)
+      return added;
+    const seen = new Set(findings.map((f) => `${f.file}|${f.line}`));
+    return { ok: true, findings: [...findings, ...added.findings.filter((f) => !seen.has(`${f.file}|${f.line}`))] };
   }
   if (res.exitCode !== 0 && res.exitCode !== 1 && res.exitCode !== 2 && elapsed >= timeoutMs) {
     return fail(`secure-scan timed out after ${timeoutMs}ms`);
@@ -12419,10 +12514,194 @@ async function runSecureScan(targetDir, opts = {}) {
 `).slice(-3).join(" | ");
   return fail(`secure-scan failed (exit ${res.exitCode}): ${tail}`);
 }
-var DEFAULT_SECURE_SCAN_TIMEOUT_MS = 120000;
+function git3(repoDir, args) {
+  const r = safeGitSpawn(repoDir, args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+  return r.status === 0 && typeof r.stdout === "string" ? r.stdout : null;
+}
+function isWorkTreeRoot(dir) {
+  const top = git3(dir, ["rev-parse", "--show-toplevel"]);
+  if (top === null)
+    return false;
+  try {
+    return realpathSync20(top.trim()) === realpathSync20(dir);
+  } catch {
+    return false;
+  }
+}
+function resolveDiffBase(repoDir, explicit) {
+  const want = explicit ?? process.env["LOKI_SECURE_SCAN_BASE"];
+  if (want)
+    return git3(repoDir, ["rev-parse", "--verify", "--quiet", `${want}^{commit}`])?.trim() || null;
+  for (const ref of ["refs/remotes/origin/HEAD", "@{upstream}"]) {
+    const mb = git3(repoDir, ["merge-base", "HEAD", ref])?.trim();
+    if (mb)
+      return mb;
+  }
+  return git3(repoDir, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"])?.trim() || null;
+}
+function parseDiffHeaderPath(header) {
+  let p = header;
+  if (p.startsWith('"')) {
+    const bytes = [];
+    let i = 1;
+    let closed = false;
+    while (i < p.length) {
+      const c = String.fromCodePoint(p.codePointAt(i));
+      if (c === '"') {
+        closed = true;
+        break;
+      }
+      if (c !== "\\") {
+        for (const b of Buffer.from(c, "utf8"))
+          bytes.push(b);
+        i += c.length;
+        continue;
+      }
+      const e = p[i + 1] ?? "";
+      const oct = /^[0-7]{3}/.exec(p.slice(i + 1, i + 4));
+      if (oct) {
+        bytes.push(parseInt(oct[0], 8));
+        i += 4;
+        continue;
+      }
+      const esc2 = { a: 7, b: 8, t: 9, n: 10, v: 11, f: 12, r: 13, '"': 34, "\\": 92 };
+      if (!(e in esc2))
+        return null;
+      bytes.push(esc2[e]);
+      i += 2;
+    }
+    if (!closed)
+      return null;
+    p = Buffer.from(bytes).toString("utf8");
+  } else if (p.endsWith("\t")) {
+    p = p.slice(0, -1);
+  }
+  return p.startsWith("b/") && p.length > 2 ? p.slice(2) : null;
+}
+function parseAddedLines(diff) {
+  const out2 = new Map;
+  let cur = null;
+  let next = 0;
+  let oldLeft = 0;
+  let newLeft = 0;
+  for (const line2 of diff.split(`
+`)) {
+    if (oldLeft > 0 || newLeft > 0) {
+      if (line2.startsWith("\\"))
+        continue;
+      if (line2.startsWith("+")) {
+        if (cur)
+          cur.set(next, line2.slice(1));
+        next++;
+        newLeft--;
+      } else if (line2.startsWith("-")) {
+        oldLeft--;
+      } else {
+        next++;
+        oldLeft--;
+        newLeft--;
+      }
+      continue;
+    }
+    if (line2.startsWith("diff --git ")) {
+      cur = null;
+      continue;
+    }
+    if (line2.startsWith("+++ ")) {
+      const p = parseDiffHeaderPath(line2.slice(4));
+      cur = p === null ? null : out2.get(p) ?? new Map;
+      if (p !== null && cur)
+        out2.set(p, cur);
+      continue;
+    }
+    const m = /^@@ -\d+(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/.exec(line2);
+    if (m) {
+      oldLeft = m[1] === undefined ? 1 : Number(m[1]);
+      next = Number(m[2]);
+      newLeft = m[3] === undefined ? 1 : Number(m[3]);
+    }
+  }
+  return out2;
+}
+async function scanAddedLines(repoDir, opts = {}) {
+  if (opts.diffBase === false || !isWorkTreeRoot(repoDir))
+    return { ok: true, findings: [] };
+  const base = resolveDiffBase(repoDir, opts.diffBase);
+  const added = new Map;
+  if (base) {
+    const diff = git3(repoDir, ["-c", "core.quotePath=false", "diff", "--src-prefix=a/", "--dst-prefix=b/", "-U0", "--no-color", "--no-ext-diff", "--no-renames", base, "--"]);
+    if (diff === null)
+      return fail(`secure-scan: git diff against ${base.slice(0, 12)} failed`);
+    for (const [p, lines2] of parseAddedLines(diff))
+      added.set(p, lines2);
+  }
+  const untracked = git3(repoDir, ["ls-files", "--others", "--exclude-standard", "-z"]);
+  if (untracked === null)
+    return fail("secure-scan: git ls-files failed");
+  for (const p of untracked.split("\x00").filter(Boolean)) {
+    try {
+      const st = statSync17(join49(repoDir, p));
+      if (!st.isFile() || st.size > MAX_ADDED_FILE_BYTES)
+        continue;
+      const lines2 = new Map;
+      readFileSync38(join49(repoDir, p), "utf8").split(`
+`).forEach((t, i) => lines2.set(i + 1, t));
+      added.set(p, lines2);
+    } catch {}
+  }
+  if (added.size === 0)
+    return { ok: true, findings: [] };
+  const mirror = mkdtempSync7(join49(tmpdir9(), "loki-secure-added-"));
+  try {
+    const root = resolve14(mirror) + sep11;
+    for (const [p, lines2] of added) {
+      if (lines2.size === 0)
+        continue;
+      const dest = resolve14(mirror, p);
+      if (!dest.startsWith(root))
+        continue;
+      const max = Math.max(...lines2.keys());
+      const body = [];
+      for (let i = 1;i <= max; i++)
+        body.push(lines2.get(i) ?? "");
+      mkdirSync19(dirname16(dest), { recursive: true });
+      writeFileSync22(dest, body.join(`
+`) + `
+`);
+    }
+    const r = await runSecureScan(mirror, { scriptPath: opts.scriptPath, timeoutMs: opts.timeoutMs, secretsEverywhere: true });
+    if (!r.ok)
+      return r;
+    const byLine = new Map;
+    for (const f of r.findings) {
+      if (f.rule !== "secret-in-client-file")
+        continue;
+      const kind = /A live (\S+)/.exec(f.message)?.[1] ?? "provider key";
+      const k = `${f.file}|${f.line}`;
+      const prev = byLine.get(k);
+      if (!prev || prev.kind === "openai-key" && kind !== "openai-key")
+        byLine.set(k, { f, kind });
+    }
+    const findings = [...byLine.values()].map(({ f, kind }) => {
+      return {
+        rule: ADDED_LINE_RULE,
+        file: f.file,
+        line: f.line,
+        severity: "HIGH",
+        message: `A ${kind} was added at ${f.file}:${f.line}; the value is withheld here.`,
+        fix: "Remove the key from the change, rotate it (assume it is compromised), and read it at runtime from an environment variable or secret manager."
+      };
+    });
+    return { ok: true, findings };
+  } finally {
+    rmSync15(mirror, { recursive: true, force: true });
+  }
+}
+var ADDED_LINE_RULE = "provider-key-in-added-line", MAX_ADDED_FILE_BYTES = 1e6, DEFAULT_SECURE_SCAN_TIMEOUT_MS = 120000;
 var init_secure_scan = __esm(() => {
   init_paths();
   init_python();
+  init_safe_git();
   init_shell();
 });
 
@@ -12532,9 +12811,9 @@ var init_route_block = __esm(() => {
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn7 } from "child_process";
 import { createHash as createHash13, randomBytes as randomBytes5 } from "crypto";
-import { existsSync as existsSync30, lstatSync as lstatSync10, mkdirSync as mkdirSync19, readdirSync as readdirSync16, readFileSync as readFileSync38, writeFileSync as writeFileSync22 } from "fs";
+import { existsSync as existsSync31, lstatSync as lstatSync10, mkdirSync as mkdirSync20, readdirSync as readdirSync16, readFileSync as readFileSync39, writeFileSync as writeFileSync23 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname16, isAbsolute as isAbsolute7, join as join50, normalize as normalize3, relative as relative6, sep as sep11 } from "path";
+import { dirname as dirname17, isAbsolute as isAbsolute8, join as join50, normalize as normalize3, relative as relative6, sep as sep12 } from "path";
 function routeFor(file) {
   let r = file.replace(/^(?:.*?\/)?(?:app|pages|src|public)\//, "").replace(/^(?:routes|pages)\//, "");
   r = r.replace(/\.(?:html|jsx|tsx|vue|svelte)$/, "").replace(/\/?(?:page|index|\+page)$/, "");
@@ -12555,16 +12834,16 @@ function checkScreens(runDir, screens) {
   for (const s of screens) {
     if (typeof s?.path !== "string" || typeof s.sha256 !== "string")
       return "evidence_screens entry is malformed";
-    if (isAbsolute7(s.path) || normalize3(s.path).startsWith(".."))
+    if (isAbsolute8(s.path) || normalize3(s.path).startsWith(".."))
       return `evidence screenshot path escapes the evidence dir: ${s.path}`;
     const file = join50(runDir, s.path);
     let cur = runDir;
-    for (const seg of normalize3(s.path).split(sep11)) {
+    for (const seg of normalize3(s.path).split(sep12)) {
       cur = join50(cur, seg);
       if (isSymlink(cur))
         return `evidence screenshot path is a symlink: ${s.path}`;
     }
-    if (!existsSync30(file))
+    if (!existsSync31(file))
       return `evidence screenshot is missing: ${s.path}`;
     if (!isRegularFile(file))
       return `evidence screenshot is not a regular file: ${s.path}`;
@@ -12608,10 +12887,10 @@ async function waitUp(url, ms, signal) {
 function openapiPaths(repoDir) {
   for (const f of ["openapi.json", "openapi.yaml", "openapi.yml", "swagger.json"]) {
     const p = join50(repoDir, f);
-    if (!existsSync30(p))
+    if (!existsSync31(p))
       continue;
     try {
-      const txt = readFileSync38(p, "utf8");
+      const txt = readFileSync39(p, "utf8");
       const paths = f.endsWith(".json") ? Object.keys(JSON.parse(txt).paths ?? {}) : [...txt.matchAll(/^ {2}(\/[^\s:]*):\s*$/gm)].map((m) => m[1]);
       return paths.filter((x) => !x.includes("{")).slice(0, 10);
     } catch {
@@ -12626,9 +12905,9 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
     return { rels: [], skipped: "playwright e2e video and trace skipped: @playwright/test is not installed in the repo" };
   try {
     const dir = join50(runDir, relDir, "e2e");
-    mkdirSync19(dir, { recursive: true });
-    writeFileSync22(join50(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
-    writeFileSync22(join50(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
+    mkdirSync20(dir, { recursive: true });
+    writeFileSync23(join50(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
+    writeFileSync23(join50(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
 `);
     if (!await shoot(pw, ["test", "--config", join50(dir, "playwright.config.cjs")], repoDir, ms, signal))
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
@@ -12725,18 +13004,18 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     const pkgPath = join50(appDir, "package.json");
     let script = null;
     if (!boot) {
-      if (!existsSync30(pkgPath)) {
-        const subs = ["backend", "frontend"].filter((d) => existsSync30(join50(repoDir, d, "package.json")));
+      if (!existsSync31(pkgPath)) {
+        const subs = ["backend", "frontend"].filter((d) => existsSync31(join50(repoDir, d, "package.json")));
         const has = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync38(join50(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync39(join50(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
         };
         return skip(noRootReason(subs, subs.filter((d) => !has(d))));
       }
-      script = pickScript(JSON.parse(readFileSync38(pkgPath, "utf8")));
+      script = pickScript(JSON.parse(readFileSync39(pkgPath, "utf8")));
       if (!script)
         return skip("no dev, preview or start script");
     }
@@ -12766,17 +13045,17 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     const evRoot = join50(runDir, "evidence");
     if (isSymlink(evRoot))
       return skip("evidence dir is a symlink");
-    mkdirSync19(evRoot, { recursive: true });
+    mkdirSync20(evRoot, { recursive: true });
     if (pages.length > 0) {
       const rel0 = join50("evidence", randomBytes5(6).toString("hex"));
-      mkdirSync19(join50(runDir, rel0));
+      mkdirSync20(join50(runDir, rel0));
       const rels = [];
       for (const route of [...new Set(pages.map(routeFor))].slice(0, opts.maxRoutes ?? MAX_ROUTES)) {
         if (aborted() || left() <= 0)
           break;
         const rel = join50(rel0, `${screenName(route)}.png`);
         const ok = await shoot(pw, ["screenshot", `${base}${route}`, join50(runDir, rel)], appDir, left(), signal);
-        if (ok && !aborted() && !isSymlink(join50(runDir, rel)) && existsSync30(join50(runDir, rel)))
+        if (ok && !aborted() && !isSymlink(join50(runDir, rel)) && existsSync31(join50(runDir, rel)))
           rels.push(rel);
       }
       if (aborted())
@@ -12802,8 +13081,8 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     if (aborted())
       return skip("aborted");
     const hdir = join50(evRoot, randomBytes5(6).toString("hex"));
-    mkdirSync19(hdir);
-    writeFileSync22(join50(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
+    mkdirSync20(hdir);
+    writeFileSync23(join50(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
 `);
     return { screens: [], http: true, skipped: null };
   } catch (e) {
@@ -12830,14 +13109,14 @@ async function sealEvidence(repoDir, runDir, o, notProven, signal, emit) {
 function receiptScreensProblem(receiptPath, receipt) {
   if (visualGateEnabled() && typeof receipt["evidence_failed"] === "string")
     return `visual evidence failed (LOKI_VISUAL_GATE=1): ${receipt["evidence_failed"]}`;
-  return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname16(receiptPath), receipt["evidence_screens"]);
+  return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname17(receiptPath), receipt["evidence_screens"]);
 }
-var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash13("sha256").update(readFileSync38(p)).digest("hex"), playwrightBin = (repoDir) => {
+var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash13("sha256").update(readFileSync39(p)).digest("hex"), playwrightBin = (repoDir) => {
   const bin = join50(repoDir, "node_modules", ".bin", "playwright");
-  return existsSync30(bin) ? bin : null;
+  return existsSync31(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
   const d = join50(repoDir, "node_modules", "@playwright", "test");
-  return existsSync30(join50(d, "package.json")) ? d : null;
+  return existsSync31(join50(d, "package.json")) ? d : null;
 }, e2eSpecSource = (pkgDir, base, routes) => `const { test } = require(${JSON.stringify(pkgDir)});
 test("loki e2e walkthrough", async ({ page }) => {
   for (const r of ${JSON.stringify(routes)}) { await page.goto(${JSON.stringify(base)} + r); await page.waitForLoadState("load"); }
@@ -12902,15 +13181,15 @@ var init_pr = __esm(() => {
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync39, rmSync as rmSync15, writeFileSync as writeFileSync23 } from "fs";
-import { dirname as dirname17, join as join52 } from "path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync21, mkdtempSync as mkdtempSync8, readFileSync as readFileSync40, rmSync as rmSync16, writeFileSync as writeFileSync24 } from "fs";
+import { dirname as dirname18, join as join52 } from "path";
 import { createHash as createHash14 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
-  if (!existsSync31(p))
+  if (!existsSync32(p))
     return [];
   try {
-    const j = JSON.parse(readFileSync39(p, "utf-8"));
+    const j = JSON.parse(readFileSync40(p, "utf-8"));
     return Array.isArray(j.lessons) ? j.lessons : [];
   } catch {
     return [];
@@ -12918,7 +13197,7 @@ function loadLessons(repoDir) {
 }
 function save(repoDir, lessons) {
   const p = lessonsPath(repoDir);
-  mkdirSync20(dirname17(p), { recursive: true });
+  mkdirSync21(dirname18(p), { recursive: true });
   atomicWriteJson(p, { version: 2, lessons });
 }
 function appendReceiptFact(repoDir, f, now2 = () => new Date) {
@@ -12984,8 +13263,8 @@ var init_attempts = __esm(() => {
 var init_mcp_config = () => {};
 
 // ../../loki-ts/src/providers/claude_flags.ts
-import { existsSync as existsSync32, readFileSync as readFileSync40 } from "fs";
-import { resolve as resolvePath, dirname as dirname18 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync41 } from "fs";
+import { resolve as resolvePath, dirname as dirname19 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function claudeFlagSupported(flag, helpText) {
   const txt = helpText ?? _claudeHelpCache;
@@ -13032,14 +13311,14 @@ function leanReviewerFlags(opts = {}) {
 }
 function designArchetypesText() {
   try {
-    const moduleDir = dirname18(fileURLToPath4(import.meta.url));
+    const moduleDir = dirname19(fileURLToPath4(import.meta.url));
     for (const rel of [
       ["..", "..", "..", "references", "design-archetypes.md"],
       ["..", "..", "references", "design-archetypes.md"]
     ]) {
       const p = resolvePath(moduleDir, ...rel);
-      if (existsSync32(p))
-        return readFileSync40(p, "utf8");
+      if (existsSync33(p))
+        return readFileSync41(p, "utf8");
     }
   } catch {}
   return "";
@@ -13123,14 +13402,14 @@ var init_providers = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync33, lstatSync as lstatSync11, mkdirSync as mkdirSync21, readFileSync as readFileSync41, writeFileSync as writeFileSync24 } from "fs";
+import { existsSync as existsSync34, lstatSync as lstatSync11, mkdirSync as mkdirSync22, readFileSync as readFileSync42, writeFileSync as writeFileSync25 } from "fs";
 import { join as join53 } from "path";
 function loadRouteRecord(runDir) {
   try {
     const p = join53(runDir, ROUTE_RECORD_FILE);
-    if (!existsSync33(p) || !lstatSync11(p).isFile())
+    if (!existsSync34(p) || !lstatSync11(p).isFile())
       return;
-    const v = JSON.parse(readFileSync41(p, "utf8"));
+    const v = JSON.parse(readFileSync42(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
   } catch {
     return;
@@ -13313,14 +13592,14 @@ __export(exports_deep, {
   DEFAULT_SECRET_SCAN_SH: () => DEFAULT_SECRET_SCAN_SH,
   DEFAULT_PUSH_SH: () => DEFAULT_PUSH_SH2
 });
-import { copyFileSync as copyFileSync3, existsSync as existsSync34, lstatSync as lstatSync12, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
-import { tmpdir as tmpdir9 } from "os";
-import { dirname as dirname19, join as join55 } from "path";
+import { copyFileSync as copyFileSync3, existsSync as existsSync35, lstatSync as lstatSync12, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync9, rmSync as rmSync17, writeFileSync as writeFileSync26 } from "fs";
+import { tmpdir as tmpdir10 } from "os";
+import { dirname as dirname20, join as join55 } from "path";
 function sessionCouncil(sessions) {
   return { async run(input, signal) {
-    const cwd = mkdtempSync8(join55(tmpdir9(), "loki-deep-council-"));
+    const cwd = mkdtempSync9(join55(tmpdir10(), "loki-deep-council-"));
     try {
-      writeFileSync25(join55(cwd, "diff.patch"), input.diff, "utf8");
+      writeFileSync26(join55(cwd, "diff.patch"), input.diff, "utf8");
       const r = await sessions.run({
         stage: "deep",
         tier: "development",
@@ -13342,7 +13621,7 @@ function sessionCouncil(sessions) {
         throw new Error("reviewer reply has no LGTM or FINDING: line");
       return { findings };
     } finally {
-      rmSync16(cwd, { recursive: true, force: true });
+      rmSync17(cwd, { recursive: true, force: true });
     }
   } };
 }
@@ -13432,21 +13711,21 @@ async function runCouncilCheck(ctx, changed, baseSha, signal, opts, checks, notP
   }
 }
 async function secureScanChanged(repoDir, changed, opts) {
-  const dir = mkdtempSync8(join55(tmpdir9(), "loki-deep-secure-"));
+  const dir = mkdtempSync9(join55(tmpdir10(), "loki-deep-secure-"));
   try {
     for (const f of changed)
-      if (existsSync34(join55(repoDir, f)) && lstatSync12(join55(repoDir, f)).isFile()) {
-        mkdirSync22(dirname19(join55(dir, f)), { recursive: true });
+      if (existsSync35(join55(repoDir, f)) && lstatSync12(join55(repoDir, f)).isFile()) {
+        mkdirSync23(dirname20(join55(dir, f)), { recursive: true });
         copyFileSync3(join55(repoDir, f), join55(dir, f));
       }
     return await runSecureScan(dir, { ...opts.secureScanPath ? { scriptPath: opts.secureScanPath } : {}, timeoutMs: 60000 });
   } finally {
-    rmSync16(dir, { recursive: true, force: true });
+    rmSync17(dir, { recursive: true, force: true });
   }
 }
 async function runSecretScan(ctx, changed, opts, checks, notProven) {
   const scriptPath = opts.secretScanShPath ?? DEFAULT_SECRET_SCAN_SH, name = "security scan", cmd = "secret-scan.sh + secure-scan.py";
-  if (!existsSync34(scriptPath)) {
+  if (!existsSync35(scriptPath)) {
     checks.push({ name, cmd, result: "not_run", duration_s: 0 });
     notProven.add(`not run: ${name} (secret-scan.sh not found)`);
     return;
@@ -13497,9 +13776,9 @@ async function postResults(ctx, opts, checks, notProven, statusState) {
   const prUrl = ctx.outputs().pr?.pr_url;
   const prNumber = prUrl ? PR_NUMBER_RE.exec(prUrl)?.[1] : undefined;
   if (prNumber) {
-    mkdirSync22(ctx.runDir, { recursive: true });
+    mkdirSync23(ctx.runDir, { recursive: true });
     const bodyFile = join55(ctx.runDir, "deep-comment.md");
-    writeFileSync25(bodyFile, buildCommentBody(checks, notProven, statusState), "utf8");
+    writeFileSync26(bodyFile, buildCommentBody(checks, notProven, statusState), "utf8");
     const commentResult = await run(["bash", scriptPath, ...commentArgv(prNumber, bodyFile)], { cwd: ctx.repoDir, env, timeoutMs: 30000 });
     if (commentResult.exitCode !== 0)
       out2.push(`deep comment not posted (engine10-push.sh exit ${commentResult.exitCode})`);
@@ -13551,8 +13830,8 @@ async function runDeep(ctx, signal, opts = {}) {
   const addendumSha256 = sha2562(canonicalJson(addendumBody));
   const sig = signReceipt(`${ctx.runId}-deep`, addendumSha256);
   const addendum = { ...addendumBody, addendum_sha256: addendumSha256, verification: { jwt: sig.jwt, kid: sig.kid } };
-  mkdirSync22(ctx.runDir, { recursive: true });
-  writeFileSync25(join55(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
+  mkdirSync23(ctx.runDir, { recursive: true });
+  writeFileSync26(join55(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
 `);
   const pushNotProven = await postResults(ctx, opts, checks, notProvenList, statusState);
   const allNotProven = [...notProvenList, ...pushNotProven];
@@ -13597,21 +13876,21 @@ var init_deep = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/verify.ts
-import { existsSync as existsSync35, mkdtempSync as mkdtempSync9, realpathSync as realpathSync19, rmSync as rmSync17 } from "fs";
-import { tmpdir as tmpdir10 } from "os";
-import { dirname as dirname20, isAbsolute as isAbsolute8, join as join56, relative as relative7 } from "path";
+import { existsSync as existsSync36, mkdtempSync as mkdtempSync10, realpathSync as realpathSync21, rmSync as rmSync18 } from "fs";
+import { tmpdir as tmpdir11 } from "os";
+import { dirname as dirname21, isAbsolute as isAbsolute9, join as join56, relative as relative7 } from "path";
 function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
   const inRepo = (p) => {
     try {
-      const r = relative7(realpathSync19(repoDir), realpathSync19(p));
-      return r !== "" && !r.startsWith("..") && !isAbsolute8(r);
+      const r = relative7(realpathSync21(repoDir), realpathSync21(p));
+      return r !== "" && !r.startsWith("..") && !isAbsolute9(r);
     } catch {
       return false;
     }
   };
   const venvEnv = process.env["VIRTUAL_ENV"];
-  const project = [join56(repoDir, ".venv", "bin", bin), join56(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join56(venvEnv, "bin", bin)] : []].find(existsSync35);
-  return project ? [project, "project", []] : existsSync35(join56(repoDir, "uv.lock")) && Bun.which("uv") ? ["uv", "project", ["run", "--", bin]] : [Bun.which(fallback) ? fallback : lastResort, "system", []];
+  const project = [join56(repoDir, ".venv", "bin", bin), join56(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join56(venvEnv, "bin", bin)] : []].find(existsSync36);
+  return project ? [project, "project", []] : existsSync36(join56(repoDir, "uv.lock")) && Bun.which("uv") ? ["uv", "project", ["run", "--", bin]] : [Bun.which(fallback) ? fallback : lastResort, "system", []];
 }
 function runnerCmd(t, repoDir) {
   switch (t.runner) {
@@ -13630,7 +13909,7 @@ function runnerCmd(t, repoDir) {
     case "npm":
       return ["npm", ["test", "--silent"]];
     case "go":
-      return ["go", ["test", "-json", `./${dirname20(t.path)}`]];
+      return ["go", ["test", "-json", `./${dirname21(t.path)}`]];
     case "cargo":
       return ["cargo", ["test"]];
   }
@@ -13725,12 +14004,12 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   const sus = pairs.filter(({ c }) => rel.has(c.name) && c.result === "pass");
   if (!(un.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length) || signal.aborted)
     return out2;
-  const dir = mkdtempSync9(join56(tmpdir10(), "e10-base-"));
-  const git3 = (args) => {
+  const dir = mkdtempSync10(join56(tmpdir11(), "e10-base-"));
+  const git4 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
   try {
-    git3(["-c", "core.hooksPath=/dev/null", "worktree", "add", "--detach", dir, ctx.baseSha]);
+    git4(["-c", "core.hooksPath=/dev/null", "worktree", "add", "--detach", dir, ctx.baseSha]);
     const base = new Map;
     for (const { c, t } of new Set([...un, ...sus])) {
       const bc = commandFor(t, dir, api);
@@ -13753,17 +14032,17 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
     }
   } catch {} finally {
     try {
-      git3(["worktree", "remove", "--force", dir]);
+      git4(["worktree", "remove", "--force", dir]);
     } catch {}
-    rmSync17(dir, { recursive: true, force: true });
+    rmSync18(dir, { recursive: true, force: true });
     try {
-      git3(["worktree", "prune"]);
+      git4(["worktree", "prune"]);
     } catch {}
   }
   return out2;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync35(join56(repoDir, "scripts", "select-tests.sh"));
+  return existsSync36(join56(repoDir, "scripts", "select-tests.sh"));
 }
 async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   const { api, ...runOpts } = opts;
@@ -13785,9 +14064,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync35(join56(g.cwd, "tsconfig.json")))
+    if (existsSync36(join56(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync35(join56(g.cwd, f)))) {
+    if (ESLINT_CONFIGS.some((f) => existsSync36(join56(g.cwd, f)))) {
       const c = await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
       if (await excuseLint(ctx, signal, c, "eslint", "npx", ["eslint"], g.cwd, g.rel, co))
         pre.push(c.name);
@@ -13861,7 +14140,7 @@ var init_verify = __esm(() => {
       const impacted = ctx.tests.impacted(map, changed);
       const changedTestFiles = map.tests.filter((t) => changed.includes(t.path));
       const wall = ctx.outputs().wall ?? {};
-      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute8(f.path) ? relative7(ctx.repoDir, f.path) : f.path));
+      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute9(f.path) ? relative7(ctx.repoDir, f.path) : f.path));
       const wallTests = map.tests.filter((t) => wallPaths.has(t.path));
       const intake = ctx.outputs().intake, relevant2 = ctx.tests.impacted(map, namedFiles(intake?.task ?? "", loadRepoMap(intake?.repomap_ref)));
       const tests = dedupeTests([...impacted, ...changedTestFiles, ...wallTests, ...relevant2]);
@@ -13967,8 +14246,8 @@ ${x}` : c.cmd };
 });
 
 // ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync36, readdirSync as readdirSync17, readFileSync as readFileSync42 } from "fs";
-import { dirname as dirname21, join as join57 } from "path";
+import { existsSync as existsSync37, readdirSync as readdirSync17, readFileSync as readFileSync43 } from "fs";
+import { dirname as dirname22, join as join57 } from "path";
 function parseJsonc(text2) {
   let out2 = "", i = 0;
   while (i < text2.length) {
@@ -14003,8 +14282,8 @@ function moduleOf(file, depth = 0) {
   const ext = typeof j.extends === "string" ? j.extends : null;
   if (!ext || !ext.startsWith("."))
     return null;
-  const next = join57(dirname21(file), ext.endsWith(".json") ? ext : `${ext}.json`);
-  return existsSync36(next) ? moduleOf(next, depth + 1) : null;
+  const next = join57(dirname22(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  return existsSync37(next) ? moduleOf(next, depth + 1) : null;
 }
 function readPackageConventions(pkgDir, runner = null) {
   let names = [];
@@ -14043,7 +14322,7 @@ function conventionViolation(c, fileName, content) {
 }
 var readJson5 = (p) => {
   try {
-    const v = parseJsonc(readFileSync42(p, "utf8"));
+    const v = parseJsonc(readFileSync43(p, "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : null;
   } catch {
     return null;
@@ -14053,95 +14332,9 @@ var init_conventions = () => {};
 
 // ../../loki-ts/src/engine10/stages/wall.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync37, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync10, readFileSync as readFileSync43, readdirSync as readdirSync18, realpathSync as realpathSync20, rmSync as rmSync18, writeFileSync as writeFileSync26 } from "fs";
-import { tmpdir as tmpdir11 } from "os";
-import { dirname as dirname22, isAbsolute as isAbsolute9, join as join58, relative as relative8 } from "path";
-function pytestCollectionIsRed(output, repoDir) {
-  if (/ModuleNotFoundError/.test(output))
-    return false;
-  const real2 = (p) => {
-    try {
-      return realpathSync20(isAbsolute9(p) ? p : join58(repoDir, p));
-    } catch {
-      return null;
-    }
-  };
-  const repoReal = real2(repoDir);
-  const under = (p) => {
-    const r = real2(p);
-    return !!repoReal && !!r && (r === repoReal || r.startsWith(`${repoReal}/`));
-  };
-  const imp = /ImportError: cannot import name .* from ['"][\w.]+['"] \(([^)]+)\)/.exec(output);
-  if (imp)
-    return under(imp[1]);
-  const hdr = [...output.matchAll(/^=+ short test summary info =+$/gm)].pop();
-  if (!hdr)
-    return false;
-  const cls = [...output.slice(hdr.index).matchAll(/^ERROR \S+ - (\w+Error): /gm)].pop()?.[1];
-  if (cls !== "AttributeError" && cls !== "NameError")
-    return false;
-  const start = output.search(/^_+ ERROR collecting /m);
-  if (start < 0 || start > hdr.index)
-    return false;
-  const block = output.slice(start, hdr.index).split(/^-+ Captured .*$/m)[0];
-  const eLines = [...block.matchAll(new RegExp(`^E {3}${cls}: (.*)$`, "gm"))];
-  const eLine = eLines[eLines.length - 1];
-  if (!eLine)
-    return false;
-  if (cls === "AttributeError") {
-    const m = /^module ['"]([\w.]+)['"] has no attribute/.exec(eLine[1]);
-    return !!m && moduleUnderRepo(repoDir, m[1]);
-  }
-  const frames = [...block.slice(0, eLine.index).matchAll(/^(.+?):\d+: in \S+\n\s*(.*)$/gm)];
-  const last = frames[frames.length - 1];
-  return !!last && under(last[1]) && !/^\s*(import\s|from\s\S+\s+import\b)/.test(last[2] ?? "");
-}
-function moduleUnderRepo(repoDir, name) {
-  const rel = name.replace(/\./g, "/");
-  return existsSync37(join58(repoDir, `${rel}.py`)) || existsSync37(join58(repoDir, rel, "__init__.py"));
-}
-function pytestExit1IsRed(output) {
-  if (/^!+ _pytest\.outcomes\.Exit\b/m.test(output))
-    return false;
-  if (/^=*\s*(\d+ \w+(, )?)*\d+ failed\b.* in [\d.]+s/.test(output.trimEnd().split(`
-`).pop() ?? ""))
-    return true;
-  const hdr = [...output.matchAll(/^=+ short test summary info =+$/gm)].pop();
-  return !!hdr && /^FAILED \S+/m.test(output.slice(hdr.index));
-}
-function parsedFailCount(runner, output) {
-  const m = runner === "bun" ? /^\s*(\d+)\s+fail\s*$/m.exec(output) : runner === "jest" ? /Tests:\s*(\d+)\s+failed/i.exec(output) : runner === "vitest" ? /Tests\s+(\d+)\s+failed/i.exec(output) : null;
-  return m ? Number(m[1]) : 0;
-}
-function nodeIsRed(f, raw2) {
-  const o = raw2.replace(/^# (?!(?:tests|suites|pass|fail|cancelled|skipped|todo|duration_ms|Subtest)\b)/gm, "");
-  const mod = /^Error(?: \[\w+\])?: Cannot find (?:module|package) '([^']+)'(?:(?!\u2716)[\s\S])*?\nNode\.js v/m.exec(o), top = /^(\S+):\d+\n.*\n.*\n\n?(?:ReferenceError|SyntaxError)\b/m.exec(o);
-  const named = [...o.matchAll(/^(?:\u2716|\s*not ok \d+ -) (?!failing tests:)(.+?)(?: \(|$)/gm)].some((m) => !f.path.endsWith(m[1]) && !m[1].endsWith(f.path)), blk = o.split("failing tests:")[1] ?? "", esm = /^SyntaxError: The requested module '([^']+)' does not provide an export named/m.exec(o), errs = [...blk.matchAll(/^ {2}(\w+Error): .*\n\s+at (?:.*\()?([^\s()]+?):\d+:\d+/gm), ...o.matchAll(/^ +name: '(\w+Error)'\n(?:.*\n)*? +stack: \|-\n\s+(?:.*\()?([^\s()]+?):\d+:\d+/gm)];
-  return /^(?:#|\u2139) fail [1-9]/m.test(raw2) && (/^ {2}AssertionError\b/m.test(blk) || /^ +name: 'AssertionError'/m.test(o) || (mod && !named ? /^[./]/.test(mod[1]) : esm ? /^[./]/.test(esm[1]) : top ? !top[1].endsWith(f.path) : !errs.length || errs.some((e) => !/^(?:Reference|Syntax)Error$/.test(e[1]) || !(e[2].startsWith("node:") || e[2].endsWith(f.path)))));
-}
-function notRunReason(status, interpreter) {
-  if (interpreter === "system")
-    return "ran under the system interpreter, not the project's, so the result proves nothing";
-  if (status === null)
-    return "the test runner did not start or timed out";
-  if (status === 126 || status === 127)
-    return `the test runner command was not found or not executable (exit ${status})`;
-  return status === 0 ? "exit 0 but no executed test count could be confirmed" : `exit ${status} but the runner output showed no readable failing test`;
-}
-function classify(f, status, output, repoDir, interpreter) {
-  if (interpreter === "system")
-    return "not_run";
-  output = stripAnsi(output);
-  if (status === null || status === 126 || status === 127)
-    return "not_run";
-  if (status === 0)
-    return classifyCheck({ kind: "test", ok: true, out: output, path: f.path, ...f.runner === "go" ? { runner: "go" } : {} }).result === "pass" ? "pass" : "not_run";
-  if (f.runner === "pytest")
-    return status === 1 ? pytestExit1IsRed(output) ? "fail" : "not_run" : status === 2 ? pytestCollectionIsRed(output, repoDir) ? "fail" : "not_run" : "not_run";
-  if (f.runner === "jest" || f.runner === "vitest" || f.runner === "bun")
-    return parsedFailCount(f.runner, output) > 0 ? "fail" : "not_run";
-  return f.runner === "node" && nodeIsRed(f, output) ? "fail" : "not_run";
-}
+import { existsSync as existsSync38, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync11, readFileSync as readFileSync44, readdirSync as readdirSync18, rmSync as rmSync19, writeFileSync as writeFileSync27 } from "fs";
+import { tmpdir as tmpdir12 } from "os";
+import { dirname as dirname23, join as join58, relative as relative8 } from "path";
 
 class RealBaseTestRunner {
   api;
@@ -14186,7 +14379,7 @@ ${repomapText}`] : [],
     ...acceptance.length ? [`Acceptance criteria frozen for this unit (each must be covered by a test):
 ${acceptance.map((a) => `Acceptance: ${a}`).join(`
 `)}`] : [],
-    "Write behavioral acceptance tests that prove the task is done. A test that errors on import, uses another framework's globals, or fails for a reason unrelated to the task is discarded.",
+    "Write behavioral acceptance tests that prove the task is done. A test that errors on import, uses another framework's globals, or fails for a reason unrelated to the task is discarded. Negative case: for each acceptance line include one assertion that rejects bad input or would fail before the fix.",
     `Test runner: ${runners.map((r) => RUNNER_HINT[r]).find(Boolean) ?? "the framework named in repomap.txt"}`,
     ...conventions ? [conventions] : [],
     `Name every file you write starting with "${WALL_PREFIX}". Write nothing else.`
@@ -14198,9 +14391,9 @@ function loadTaskText(ctx, fromPrior) {
   if (fromPrior)
     return fromPrior;
   const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join58(ctx.runDir, "issue.json");
-  if (existsSync37(issueJsonPath)) {
+  if (existsSync38(issueJsonPath)) {
     try {
-      const issue = JSON.parse(readFileSync43(issueJsonPath, "utf8"));
+      const issue = JSON.parse(readFileSync44(issueJsonPath, "utf8"));
       const text2 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
 
 `);
@@ -14212,7 +14405,7 @@ function loadTaskText(ctx, fromPrior) {
 }
 function wallTargetDir(repoDir, existingTests) {
   const first = existingTests[0];
-  return first ? join58(repoDir, dirname22(first.path)) : join58(repoDir, "tests");
+  return first ? join58(repoDir, dirname23(first.path)) : join58(repoDir, "tests");
 }
 function guessRunner(fileName, runners) {
   if (fileName.endsWith(".py"))
@@ -14246,10 +14439,10 @@ async function wallAuthor(ctx, signal, retry) {
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
   const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative8(ctx.repoDir, targetDir)}/x`);
   const conv2 = readPackageConventions(join58(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync10(join58(tmpdir11(), "loki-e15-wall-"));
+  const cwd = mkdtempSync11(join58(tmpdir12(), "loki-e15-wall-"));
   const wm = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n2, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm ? [["wall_manifest.txt", wm.text]] : []])
-    writeFileSync26(join58(cwd, n2), c, "utf8");
+    writeFileSync27(join58(cwd, n2), c, "utf8");
   const model = retry?.model ?? wallFirstModel(sz.size), iterationId = `${ctx.runId}-wall${retry?.suffix ?? ""}`;
   const session = await ctx.sessions.run({
     stage: "wall",
@@ -14262,30 +14455,30 @@ async function wallAuthor(ctx, signal, retry) {
     cwd
   });
   if (session.killed || session.exit === null) {
-    rmSync18(cwd, { recursive: true, force: true });
+    rmSync19(cwd, { recursive: true, force: true });
     return done({ status: "failed", data: { iteration_ids: [iterationId], model }, reason: "wall session aborted, killed, or timed out", killed: true });
   }
-  const all = readdirSync18(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync43(join58(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
+  const all = readdirSync18(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync44(join58(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
   const sealedDir = join58(ctx.runDir, "wall");
   if (generated.length > 0)
-    mkdirSync23(sealedDir, { recursive: true });
+    mkdirSync24(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync43(join58(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
-    writeFileSync26(join58(sealedDir, name), content, "utf8");
+    const content = readFileSync44(join58(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
+    writeFileSync27(join58(sealedDir, name), content, "utf8");
     if (bad)
       discarded.push({ file: name, reason: `${bad}; wall test did not compile under the package config` });
     else
       contents.set(name, content);
   }
-  rmSync18(cwd, { recursive: true, force: true });
+  rmSync19(cwd, { recursive: true, force: true });
   return { kind: "authored", model, iterationId, task, sizeName: sz.size, runners, targetDir, generated, contents, discarded, ...wm ? { manifestSha256: wm.sha256 } : {}, ...held ? { holdoutDir: held.dir } : {} };
 }
 function installWall(ctx, a, baseDir, opts = {}) {
   const { generated, contents, discarded, targetDir, runners } = a;
   if (generated.length > 0)
-    mkdirSync23(targetDir, { recursive: true });
+    mkdirSync24(targetDir, { recursive: true });
   const sealedFiles = [];
   const readOnlyFiles = [];
   const wallTests = [];
@@ -14294,7 +14487,7 @@ function installWall(ctx, a, baseDir, opts = {}) {
     if (content === undefined)
       continue;
     const dest = join58(targetDir, name), runner = guessRunner(name, runners);
-    writeFileSync26(dest, content, "utf8");
+    writeFileSync27(dest, content, "utf8");
     sealedFiles.push({ path: dest, sha256: sha2562(content) });
     readOnlyFiles.push({ path: dest, content });
     if (runner)
@@ -14310,7 +14503,7 @@ function installWall(ctx, a, baseDir, opts = {}) {
     baseRun.not_run += r.not_run ?? 0;
     notRunFiles.push(...baseRunner.lastNotRunFiles ?? []);
     if (r.pass + r.fail === 0) {
-      rmSync18(abs, { force: true });
+      rmSync19(abs, { force: true });
       for (const l of [sealedFiles, readOnlyFiles])
         l.splice(0, l.length, ...l.filter((f) => f.path !== abs));
     }
@@ -14343,8 +14536,8 @@ async function runWall(ctx, signal, opts = {}) {
     return green ? { ...first, data: distrustGreenBase(first.data) } : first;
   if (a.kind === "authored") {
     for (const f of first.data.files ?? [])
-      rmSync18(f.path, { force: true });
-    rmSync18(join58(ctx.runDir, "wall"), { recursive: true, force: true });
+      rmSync19(f.path, { force: true });
+    rmSync19(join58(ctx.runDir, "wall"), { recursive: true, force: true });
     ctx.wallSealed = false;
   }
   removeHoldout(ctx.runId, ctx.repoDir);
@@ -14367,6 +14560,7 @@ var init_wall = __esm(() => {
   init_resolve();
   init_check_result();
   init_conventions();
+  init_check_result();
   WALL_RUNG_S = WALL_SESSION_MAX_S + WALL_BASE_FILES * (BASE_RUN_TIMEOUT_MS / 1000);
   WALL_STAGE_LIMIT_S = 2 * WALL_RUNG_S;
   wallStage = {
@@ -14379,20 +14573,20 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync13, mkdirSync as mkdirSync24, openSync as openSync9, readFileSync as readFileSync44, realpathSync as realpathSync21, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync27 } from "fs";
-import { dirname as dirname23, join as join59, relative as relative9, sep as sep12 } from "path";
+import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync13, mkdirSync as mkdirSync25, openSync as openSync9, readFileSync as readFileSync45, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync28 } from "fs";
+import { dirname as dirname24, join as join59, relative as relative9, sep as sep13 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync21(repoDir), fp = join59(root, f), rel = relative9(root, dirname23(fp));
+  const root = realpathSync23(repoDir), fp = join59(root, f), rel = relative9(root, dirname24(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
-  for (const part of rel === "" ? [] : rel.split(sep12)) {
+  for (const part of rel === "" ? [] : rel.split(sep13)) {
     cur = join59(cur, part);
     let st2;
     try {
       st2 = lstatSync13(cur);
     } catch {
-      mkdirSync24(cur);
+      mkdirSync25(cur);
       continue;
     }
     if (!st2.isDirectory())
@@ -14404,7 +14598,7 @@ function safeRestore(repoDir, f, want, mode) {
   } catch {
     st = null;
   }
-  if (st?.isFile() && readFileSync44(fp).equals(want)) {
+  if (st?.isFile() && readFileSync45(fp).equals(want)) {
     chmodSync5(fp, mode);
     return;
   }
@@ -14416,7 +14610,7 @@ function safeRestore(repoDir, f, want, mode) {
   }
   const fd = openSync9(fp, "wx", mode);
   try {
-    writeFileSync27(fd, want);
+    writeFileSync28(fd, want);
   } finally {
     closeSync9(fd);
   }
@@ -14432,13 +14626,13 @@ function catBlob(repoDir, sha3) {
     throw r.error ?? new Error(`git cat-file blob ${sha3} failed`);
   return r.stdout;
 }
-async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
+async function discardIfSatisfied(git4, base, o, staged, keep, repoDir) {
   if (!alreadySatisfied(o))
     return null;
   const pre = Object.assign(Object.create(null), o.intake?.preexisting_dirty ?? {}), own = new Set([...Array.isArray(o.intake?.preexisting_untracked) ? o.intake.preexisting_untracked : [], ...Object.keys(o.intake?.preexisting_untracked_blobs ?? {})]);
   const gone = staged.filter(({ f }) => !keep.has(f) && !own.has(f) && !Object.hasOwn(pre, f) && !f.startsWith(".loki/")), lit = ["--literal-pathspecs"];
   const del = gone.filter(({ st }) => st === "A").map(({ f }) => f), back = gone.filter(({ st }) => st !== "A").map(({ f }) => f);
-  if (del.length > 0 && (await git3([...lit, "rm", "-q", "-f", "--", ...del])).code !== 0 || back.length > 0 && (await git3([...lit, "restore", `--source=${base}`, "--staged", "--worktree", "--", ...back])).code !== 0 || (await git3(["reset", "-q", base])).code !== 0)
+  if (del.length > 0 && (await git4([...lit, "rm", "-q", "-f", "--", ...del])).code !== 0 || back.length > 0 && (await git4([...lit, "restore", `--source=${base}`, "--staged", "--worktree", "--", ...back])).code !== 0 || (await git4(["reset", "-q", base])).code !== 0)
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
@@ -14494,9 +14688,9 @@ var init_preexisting_dirty = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/commit_filter.ts
-import { dirname as dirname24 } from "path";
+import { dirname as dirname25 } from "path";
 function dropSet(repoDir, staged, preexistingDirty, env = process.env) {
-  return staged.concat(untouchedSinceIntake(repoDir, preexistingDirty, env).map((f) => ({ st: "L", f }))).filter(({ st, f }) => f.startsWith(".loki/") || st === "L" || /(^|\/)loki_wall_[^/]*$/.test(f) || st === "A" && !staged.some(({ f: m }) => /(^|\/)(package\.json|pyproject\.toml|requirements\.txt|Cargo\.toml|go\.mod)$/.test(m) && dirname24(m) === dirname24(f)) && /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|Cargo\.lock|go\.sum)$/.test(f));
+  return staged.concat(untouchedSinceIntake(repoDir, preexistingDirty, env).map((f) => ({ st: "L", f }))).filter(({ st, f }) => f.startsWith(".loki/") || st === "L" || /(^|\/)loki_wall_[^/]*$/.test(f) || st === "A" && !staged.some(({ f: m }) => /(^|\/)(package\.json|pyproject\.toml|requirements\.txt|Cargo\.toml|go\.mod)$/.test(m) && dirname25(m) === dirname25(f)) && /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|Cargo\.lock|go\.sum)$/.test(f));
 }
 var parseStaged = (out2) => out2.split("\x00").reduce((a, t, i, all) => i % 2 === 0 && t ? [...a, { st: t, f: all[i + 1] }] : a, []);
 var init_commit_filter = __esm(() => {
@@ -14505,7 +14699,7 @@ var init_commit_filter = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename20, dirname as dirname25 } from "path";
+import { basename as basename20, dirname as dirname26 } from "path";
 function contractText(o) {
   const c = o.intake?.contract_snapshot?.contract;
   return Array.isArray(c?.criteria) ? c.criteria.map((x) => typeof x?.text === "string" ? x.text : "").join(`
@@ -14519,8 +14713,8 @@ function outsideScope(o, staged) {
   const text2 = `${plan}
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
-  const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname25(r)).filter((d) => d !== "."));
-  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename20(f)) && !plannedDirs.has(dirname25(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname26(r)).filter((d) => d !== "."));
+  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename20(f)) && !plannedDirs.has(dirname26(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
@@ -14535,14 +14729,14 @@ var init_scope2 = __esm(() => {
 });
 
 // ../../loki-ts/src/council/role_agents.ts
-import { existsSync as existsSync38, readdirSync as readdirSync19, readFileSync as readFileSync45 } from "fs";
+import { existsSync as existsSync39, readdirSync as readdirSync19, readFileSync as readFileSync46 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join60 } from "path";
 function agentDirs(repoDir, env = process.env) {
   return [env["LOKI_AGENTS_PROJECT_DIR"] || join60(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join60(env["XDG_CONFIG_HOME"] || join60(homedir9(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync45(file, "utf8"));
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync46(file, "utf8"));
   if (!m)
     return null;
   const body = m[2].trim();
@@ -14556,7 +14750,7 @@ function parseAgent(file, stem2) {
 }
 function loadRoleAgent(repoDir, role, env = process.env) {
   for (const d of agentDirs(repoDir, env)) {
-    if (!existsSync38(d))
+    if (!existsSync39(d))
       continue;
     let names;
     try {
@@ -14584,7 +14778,7 @@ var init_role_agents = __esm(() => {
 });
 
 // ../../loki-ts/src/util/child_ledger.ts
-import { appendFileSync as appendFileSync4, mkdirSync as mkdirSync25 } from "fs";
+import { appendFileSync as appendFileSync4, mkdirSync as mkdirSync26 } from "fs";
 import { join as join61 } from "path";
 function unmeasuredRecord(phase, model, source) {
   return { phase, model, input_tokens: 0, output_tokens: 0, cache_creation_tokens: 0, cache_read_tokens: 0, source, cost_status: "unmeasured" };
@@ -14611,7 +14805,7 @@ function recordFromClaudeResult(phase, payload, source = "claude-json") {
 function appendChildLedger(lokiDir2, rec2) {
   try {
     const dir = join61(lokiDir2, "metrics");
-    mkdirSync25(dir, { recursive: true });
+    mkdirSync26(dir, { recursive: true });
     appendFileSync4(join61(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
 `);
     return true;
@@ -14642,14 +14836,14 @@ var init_child_ledger = __esm(() => {
 });
 
 // ../../loki-ts/src/util/run_summary.ts
-import { existsSync as existsSync39, mkdirSync as mkdirSync26, readFileSync as readFileSync46, renameSync as renameSync12, statSync as statSync17, writeFileSync as writeFileSync28 } from "fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync27, readFileSync as readFileSync47, renameSync as renameSync12, statSync as statSync18, writeFileSync as writeFileSync29 } from "fs";
 import { join as join62 } from "path";
 function readRiskRecord(repoDir, sinceMs = 0) {
   try {
     const p = join62(repoDir, ".loki", "state", "risk-tier.json");
-    if (statSync17(p).mtimeMs < sinceMs)
+    if (statSync18(p).mtimeMs < sinceMs)
       return null;
-    const r = JSON.parse(readFileSync46(p, "utf8"));
+    const r = JSON.parse(readFileSync47(p, "utf8"));
     return r && typeof r === "object" ? r : null;
   } catch {
     return null;
@@ -14663,7 +14857,7 @@ var init_run_summary = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { existsSync as existsSync40, readFileSync as readFileSync47 } from "fs";
+import { existsSync as existsSync41, readFileSync as readFileSync48 } from "fs";
 import { join as join63 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
@@ -14678,10 +14872,10 @@ function explicitReview(repoDir, env) {
     return "off";
   for (const f of ["loki.yaml", "loki.yml"]) {
     const p = join63(repoDir, f);
-    if (!existsSync40(p))
+    if (!existsSync41(p))
       continue;
     try {
-      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync47(p, "utf8"));
+      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync48(p, "utf8"));
       const v = asProvider(m?.[1]);
       if (v)
         return v;
@@ -14859,8 +15053,8 @@ See also: loki cost --detail (what a run ALREADY spent)
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync41, lstatSync as lstatSync14, mkdirSync as mkdirSync27, readFileSync as readFileSync48, rmSync as rmSync19, writeFileSync as writeFileSync29 } from "fs";
-import { dirname as dirname26, join as join64 } from "path";
+import { existsSync as existsSync42, lstatSync as lstatSync14, mkdirSync as mkdirSync28, readFileSync as readFileSync49, rmSync as rmSync20, writeFileSync as writeFileSync30 } from "fs";
+import { dirname as dirname27, join as join64 } from "path";
 import { createHash as createHash15 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
@@ -14908,7 +15102,7 @@ function readContract(repoDir) {
     return { contract: null, notes: ["contract unreadable: too large"], sha256: null };
   let raw2;
   try {
-    raw2 = readFileSync48(p);
+    raw2 = readFileSync49(p);
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
@@ -14983,11 +15177,11 @@ var init_contract = __esm(() => {
 
 // ../../loki-ts/src/features/speed/seal_group.ts
 import { createHash as createHash16 } from "crypto";
-import { existsSync as existsSync42, mkdirSync as mkdirSync28, readdirSync as readdirSync20, readFileSync as readFileSync49, renameSync as renameSync13, statSync as statSync18, writeFileSync as writeFileSync30 } from "fs";
-import { dirname as dirname27, join as join65 } from "path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync29, readdirSync as readdirSync20, readFileSync as readFileSync50, renameSync as renameSync13, statSync as statSync19, writeFileSync as writeFileSync31 } from "fs";
+import { dirname as dirname28, join as join65 } from "path";
 function sealGroup(runDir, rh) {
   const manifestPath = join65(runDir, "group", "manifest.json");
-  if (!existsSync42(manifestPath))
+  if (!existsSync43(manifestPath))
     return { section: undefined, notProven: [], problems: 0, allUnitsPass: true };
   const notProven = [];
   let problems = 0;
@@ -15014,7 +15208,7 @@ function sealGroup(runDir, rh) {
     const dir = join65(unitsDir(runDir), id), rp = join65(dir, "receipt.json"), ep = join65(dir, "events.jsonl");
     let bytes;
     try {
-      bytes = readFileSync49(rp);
+      bytes = readFileSync50(rp);
     } catch {
       return fail2(`unit ${id} sub-receipt missing`);
     }
@@ -15031,7 +15225,7 @@ function sealGroup(runDir, rh) {
       unit_id: id,
       sub_receipt_sha256: sha3(bytes),
       receipt_sha256: sub["receipt_sha256"],
-      events_file_sha256: existsSync42(ep) ? sha3(readFileSync49(ep)) : null,
+      events_file_sha256: existsSync43(ep) ? sha3(readFileSync50(ep)) : null,
       verdict,
       goal: text2(u["goal"], 200),
       files: (Array.isArray(u["files"]) ? u["files"] : []).map((f) => text2(f, 200)).filter(Boolean).slice(0, 50),
@@ -15051,12 +15245,12 @@ function capGroupVerdict(v, g) {
   return !g.allUnitsPass && (v === "VERIFIED" || v === "ALREADY_SATISFIED") ? "PARTIAL" : v;
 }
 async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
-  const runDir = dirname27(receiptPath);
+  const runDir = dirname28(receiptPath);
   const signed = isObj10(receipt["verification"]) && typeof receipt["verification"]["jwt"] === "string";
   const bad = (reason) => ({ verdict: "TAMPERED", reason: `group: ${reason}` });
   const g = receipt["group"];
   if (g === undefined)
-    return existsSync42(join65(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
+    return existsSync43(join65(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
   if (!isObj10(g) || !ID_RE.test(String(g["group_id"] ?? "")) || !Array.isArray(g["units"]) || g["units"].length === 0)
     return bad("group section malformed");
   const entries = g["units"];
@@ -15073,15 +15267,15 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
       return bad(`unit ${id} is out of order (index ${String(e["index"])} at position ${i})`);
     let bytes;
     try {
-      if (!statSync18(dir).isDirectory())
+      if (!statSync19(dir).isDirectory())
         return bad(`unit ${id} is not a directory`);
-      bytes = readFileSync49(rp);
+      bytes = readFileSync50(rp);
     } catch {
       return bad(`unit ${id} sub-receipt missing`);
     }
     if (sha3(bytes) !== e["sub_receipt_sha256"])
       return bad(`unit ${id} sub-receipt does not match its recorded hash`);
-    const evSha = existsSync42(ep) ? sha3(readFileSync49(ep)) : null;
+    const evSha = existsSync43(ep) ? sha3(readFileSync50(ep)) : null;
     if (evSha !== (e["events_file_sha256"] ?? null))
       return bad(`unit ${id} events.jsonl does not match its recorded hash`);
     const sub = readJson6(rp);
@@ -15106,7 +15300,7 @@ function compositeVerdict(childVerdicts) {
 }
 var ID_RE, PASSING, sha3 = (b) => createHash16("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join65(runDir, "group", "units"), readJson6 = (p) => {
   try {
-    return JSON.parse(readFileSync49(p, "utf8"));
+    return JSON.parse(readFileSync50(p, "utf8"));
   } catch {
     return;
   }
@@ -15124,7 +15318,7 @@ var init_seal_group = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync43, readFileSync as readFileSync50, statSync as statSync19 } from "fs";
+import { existsSync as existsSync44, readFileSync as readFileSync51, statSync as statSync20 } from "fs";
 import { basename as basename21, join as join66 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
@@ -15141,12 +15335,12 @@ function isManifestPath(path) {
 }
 function readDeclared(repoDir) {
   const p = join66(repoDir, ".loki", DECLARED_FILE);
-  if (!existsSync43(p))
+  if (!existsSync44(p))
     return { deps: [], problem: null };
   try {
-    if (statSync19(p).size > MAX_FILE_BYTES)
+    if (statSync20(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
-    const j = JSON.parse(readFileSync50(p, "utf8"));
+    const j = JSON.parse(readFileSync51(p, "utf8"));
     if (!Array.isArray(j))
       return { deps: [], problem: "declaration is not a JSON array" };
     const deps = [];
@@ -15167,10 +15361,10 @@ function readDeclared(repoDir) {
 }
 function readAllowlist(repoDir) {
   const p = join66(repoDir, ".loki", "supply-allowlist");
-  if (!existsSync43(p))
+  if (!existsSync44(p))
     return new Set;
   try {
-    return new Set(readFileSync50(p, "utf8").split(`
+    return new Set(readFileSync51(p, "utf8").split(`
 `).map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean));
   } catch {
     return new Set;
@@ -15353,7 +15547,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u) => u.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u) => /[a-z0-9]/i.test(u) && !PUBLIC_HOSTS.has(hostOf(u)), readSmall = (p) => {
   try {
-    return statSync19(p).size <= MAX_FILE_BYTES ? readFileSync50(p, "utf8") : "";
+    return statSync20(p).size <= MAX_FILE_BYTES ? readFileSync51(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -15369,8 +15563,8 @@ var init_supply_guard = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/seal.ts
 import { createHash as createHash17 } from "crypto";
-import { existsSync as existsSync44, readdirSync as readdirSync21, mkdirSync as mkdirSync29, readFileSync as readFileSync51, writeFileSync as writeFileSync31 } from "fs";
-import { basename as basename22, isAbsolute as isAbsolute10, join as join67, relative as relative10 } from "path";
+import { existsSync as existsSync45, readdirSync as readdirSync21, mkdirSync as mkdirSync30, readFileSync as readFileSync52, writeFileSync as writeFileSync32 } from "fs";
+import { basename as basename22, isAbsolute as isAbsolute11, join as join67, relative as relative10 } from "path";
 function sanitizeReason(s) {
   const collapsed = s.replace(/[\x00-\x1f\x7f]+/g, " ").trim();
   const capped = collapsed.length > 500 ? `${collapsed.slice(0, 500)}...` : collapsed;
@@ -15380,7 +15574,7 @@ function receiptSha256(r) {
   const { verification: _v, receipt_sha256: _h, ...body } = r;
   return sha2562(canonicalJson(body));
 }
-async function git3(ctx, args, keep = {}) {
+async function git4(ctx, args, keep = {}) {
   const r = await safeGitRun(ctx.repoDir, args, { timeoutMs: 20000, ...keep });
   return { out: r.stdout, code: r.exitCode };
 }
@@ -15447,7 +15641,7 @@ function renderReceiptMd(r) {
 }
 var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash17("sha256").update(s).digest("hex"), str3 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], receiptRel = (ctx) => {
   const r = relative10(ctx.repoDir, join67(ctx.runDir, "receipt.json"));
-  return r.startsWith("..") || isAbsolute10(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
+  return r.startsWith("..") || isAbsolute11(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, wallGreenOnBaseOf = (o) => {
   const b = o.wall?.base_run ?? {};
   return typeof b.pass === "number" && b.pass > 0 && b.fail === 0 && (typeof b.not_run === "number" ? b.not_run : 0) === 0;
@@ -15484,30 +15678,30 @@ var init_seal = __esm(() => {
     name: "commit",
     ...STAGE_BUDGETS.commit,
     async run(ctx) {
-      if (!ctx.baseSha || (await git3(ctx, ["rev-parse", "--verify", "-q", `${ctx.baseSha}^{commit}`])).code !== 0)
+      if (!ctx.baseSha || (await git4(ctx, ["rev-parse", "--verify", "-q", `${ctx.baseSha}^{commit}`])).code !== 0)
         return { status: "failed", data: {}, reason: "base commit not resolvable" };
-      if ((await git3(ctx, ["add", "-A", "--", "."], { repoDrivers: true })).code !== 0)
+      if ((await git4(ctx, ["add", "-A", "--", "."], { repoDrivers: true })).code !== 0)
         return { status: "failed", data: {}, reason: "git add failed" };
-      const sd = await git3(ctx, ["diff", "--cached", "--name-status", "--no-renames", "-z", ctx.baseSha]);
+      const sd = await git4(ctx, ["diff", "--cached", "--name-status", "--no-renames", "-z", ctx.baseSha]);
       if (sd.code !== 0)
         return { status: "failed", data: {}, reason: "git diff against base failed" };
       const staged = parseStaged(sd.out);
       const drop = dropSet(ctx.repoDir, staged, ctx.outputs().intake?.preexisting_dirty);
-      const sat = await discardIfSatisfied((a) => git3(ctx, a), ctx.baseSha, ctx.outputs(), staged, new Set(drop.filter(({ st }) => st === "L").map(({ f }) => f)), ctx.repoDir);
+      const sat = await discardIfSatisfied((a) => git4(ctx, a), ctx.baseSha, ctx.outputs(), staged, new Set(drop.filter(({ st }) => st === "L").map(({ f }) => f)), ctx.repoDir);
       if (sat)
         return sat;
-      if (drop.length > 0 && (await git3(ctx, ["--literal-pathspecs", "reset", "-q", ctx.baseSha, "--", ...drop.map(({ f }) => f)])).code !== 0)
+      if (drop.length > 0 && (await git4(ctx, ["--literal-pathspecs", "reset", "-q", ctx.baseSha, "--", ...drop.map(({ f }) => f)])).code !== 0)
         return { status: "failed", data: {}, reason: "git reset failed" };
       const dropped2 = new Set(drop.map(({ f }) => f)), notes = flagOutsideScope(ctx.outputs(), staged.filter(({ f }) => !dropped2.has(f)));
-      if ((await git3(ctx, ["diff", "--cached", "--quiet"])).code === 0)
+      if ((await git4(ctx, ["diff", "--cached", "--quiet"])).code === 0)
         return { status: "completed", data: { committed: false, scope_notes: notes } };
       const title = (str3(ctx.outputs().intake?.title) ?? `run ${ctx.runId}`).split(`
 `)[0].slice(0, 72);
-      const c = await git3(ctx, ["commit", "-q", "-m", `loki: ${title}`, "-m", [`Loki-Run: ${ctx.runId}`, ...aiTrailers({ runId: ctx.runId, provider: ctx.provider, model: ctx.model, receiptRel: receiptRel(ctx) })].join(`
+      const c = await git4(ctx, ["commit", "-q", "-m", `loki: ${title}`, "-m", [`Loki-Run: ${ctx.runId}`, ...aiTrailers({ runId: ctx.runId, provider: ctx.provider, model: ctx.model, receiptRel: receiptRel(ctx) })].join(`
 `)], { repoDrivers: true, userHooks: true });
       if (c.code !== 0)
         return { status: "failed", data: {}, reason: "git commit failed" };
-      return { status: "completed", data: { committed: true, head_sha: (await git3(ctx, ["rev-parse", "HEAD"])).out.trim(), scope_notes: notes } };
+      return { status: "completed", data: { committed: true, head_sha: (await git4(ctx, ["rev-parse", "HEAD"])).out.trim(), scope_notes: notes } };
     }
   };
   sealStage = {
@@ -15517,8 +15711,8 @@ var init_seal = __esm(() => {
       const o = ctx.outputs(), stale = staleAtSeal(ctx.repoDir, ctx);
       if (stale.length)
         return { status: "failed", data: { stale_wall_revisions: stale.map((r) => r.rev) }, reason: staleReason(stale) };
-      const head = (await git3(ctx, ["rev-parse", "HEAD"])).out.trim();
-      const tree = (await git3(ctx, ["rev-parse", "HEAD^{tree}"])).out.trim();
+      const head = (await git4(ctx, ["rev-parse", "HEAD"])).out.trim();
+      const tree = (await git4(ctx, ["rev-parse", "HEAD^{tree}"])).out.trim();
       const diff = await safeGitRun(ctx.repoDir, ["diff-tree", "-r", "-z", "--raw", "--no-renames", "--no-abbrev", "-O/dev/null", ctx.baseSha, head, "--", ".", EXCLUDE_LOKI], { timeoutMs: 20000 });
       const diffOk = diff.exitCode === 0 && /^[0-9a-f]{40,64}$/.test(head);
       const verifyNotProven = strs2(o.verify?.not_proven);
@@ -15526,7 +15720,7 @@ var init_seal = __esm(() => {
       const wallNotRun = typeof base.not_run === "number" ? base.not_run : 0;
       const wallGreenOnBase = wallGreenOnBaseOf(o);
       const preRedChecks = strs2(o.verify?.pre_red_checks);
-      const rawDiff = diffOk ? diff.stdout.split("\x00").filter(Boolean) : [], pctx = { addedFiles: rawDiff.flatMap((m, i) => i % 2 === 0 && m.trim().split(" ").pop() === "A" && rawDiff[i + 1] ? [rawDiff[i + 1]] : []), wallFiles: Array.isArray(o.wall?.files) ? o.wall.files.map((f) => String(f.path)) : [] }, checks = checksOf(o.verify?.checks, pctx);
+      const rawDiff = diffOk ? diff.stdout.split("\x00").filter(Boolean) : [], pctx = { addedFiles: rawDiff.flatMap((m, i) => i % 2 === 0 && m.trim().split(" ").pop() === "A" && rawDiff[i + 1] ? [rawDiff[i + 1]] : []), wallFiles: Array.isArray(o.wall?.files) ? o.wall.files.map((f) => String(f.path)) : [], modifiedFiles: rawDiff.flatMap((m, i) => i % 2 === 0 && m.trim().split(" ").pop() !== "A" && rawDiff[i + 1] && isTestFile(rawDiff[i + 1]) ? [rawDiff[i + 1]] : []) }, checks = checksOf(o.verify?.checks, pctx);
       const weakTests = [];
       for (let i = 0;i + 1 < rawDiff.length; i += 2)
         if ((rawDiff[i].trim().split(" ").pop() ?? "") !== "A" && isTestFile(rawDiff[i + 1]))
@@ -15676,7 +15870,7 @@ var init_seal = __esm(() => {
         provider: ctx.provider,
         model: ctx.model,
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync44(eventsPath) ? readFileSync51(eventsPath) : ""),
+        events_sha256: sha2562(existsSync45(eventsPath) ? readFileSync52(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         ...receiptBlock(process.env, cost.usd, cost.unmetered === true, totalS),
@@ -15697,11 +15891,11 @@ var init_seal = __esm(() => {
         hash = receiptSha256(body);
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
-      mkdirSync29(ctx.runDir, { recursive: true });
+      mkdirSync30(ctx.runDir, { recursive: true });
       const path = join67(ctx.runDir, "receipt.json");
-      writeFileSync31(path, JSON.stringify(receipt, null, 2) + `
+      writeFileSync32(path, JSON.stringify(receipt, null, 2) + `
 `);
-      writeFileSync31(join67(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      writeFileSync32(join67(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ranModel(o.implement, ctx.model, o.fix), verdict, cost.usd, cost.unmetered === true, totalS);
       try {
         hooks.sealed?.(ctx.runDir, JSON.parse(JSON.stringify(receipt), (_k, v) => v && typeof v === "object" ? Object.freeze(v) : v));
@@ -15727,7 +15921,7 @@ var init_seal = __esm(() => {
 
 // ../../loki-ts/src/features/receipt_dsse.ts
 import { createPublicKey as createPublicKey3, sign as sign2, verify as verify3 } from "crypto";
-import { readFileSync as readFileSync52 } from "fs";
+import { readFileSync as readFileSync53 } from "fs";
 function pae(payloadType, body) {
   const t = Buffer.from(payloadType, "utf8");
   return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
@@ -15804,7 +15998,7 @@ function verifyDsseReceipt(env, d) {
 }
 function runIdGuard(receiptPath, runId) {
   try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync52(receiptPath, "utf8")), runId);
+    return envelopeRunIdProblem(JSON.parse(readFileSync53(receiptPath, "utf8")), runId);
   } catch {
     return null;
   }
@@ -15813,14 +16007,14 @@ var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json", STATEMENT_TYPE = "https:
 var init_receipt_dsse = () => {};
 
 // ../../loki-ts/src/util/composite_seal.ts
-import { existsSync as existsSync45, readFileSync as readFileSync53 } from "fs";
-import { basename as basename23, dirname as dirname29, join as join68 } from "path";
+import { existsSync as existsSync46, readFileSync as readFileSync54 } from "fs";
+import { basename as basename23, dirname as dirname30, join as join68 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
   let b;
   try {
-    b = readFileSync53(join68(runDir, "integration.log"));
+    b = readFileSync54(join68(runDir, "integration.log"));
   } catch {
     return "integration.log is missing but integration.json records its hash";
   }
@@ -15835,7 +16029,7 @@ function integrationProblem(integ) {
   return null;
 }
 async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
-  const runDir = dirname29(receiptPath);
+  const runDir = dirname30(receiptPath);
   const signed = isObj10(receipt["verification"]) && typeof receipt["verification"]["jwt"] === "string";
   const bad = (reason) => ({ problem: { verdict: "TAMPERED", reason: `composite: ${reason}` }, verdict: "FAILED" });
   const kids = receipt["children"];
@@ -15843,7 +16037,7 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("body malformed");
   let ibytes;
   try {
-    ibytes = readFileSync53(join68(runDir, "integration.json"));
+    ibytes = readFileSync54(join68(runDir, "integration.json"));
   } catch {
     return bad("integration.json missing");
   }
@@ -15882,7 +16076,7 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     const rp = join68(runDir, rel);
     let bytes;
     try {
-      bytes = readFileSync53(rp);
+      bytes = readFileSync54(rp);
     } catch {
       return bad(`child ${repo} receipt missing`);
     }
@@ -15931,8 +16125,8 @@ var init_keys_cmd = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
-import { existsSync as existsSync46, readFileSync as readFileSync54, renameSync as renameSync14, statSync as statSync21, writeFileSync as writeFileSync32 } from "fs";
-import { basename as basename24, dirname as dirname30, join as join69 } from "path";
+import { existsSync as existsSync47, readFileSync as readFileSync55, renameSync as renameSync14, statSync as statSync22, writeFileSync as writeFileSync33 } from "fs";
+import { basename as basename24, dirname as dirname31, join as join69 } from "path";
 import { createHash as createHash18, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
@@ -15940,7 +16134,7 @@ function pubFor(kid, given) {
   const active = loadSigningKey(false);
   const pubs = (process.env["LOKI_RECEIPT_RETIRED_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
     try {
-      return [createPublicKey4(readFileSync54(f))];
+      return [createPublicKey4(readFileSync55(f))];
     } catch {
       return [];
     }
@@ -15984,10 +16178,10 @@ function checkEventLog(receiptPath, receipt) {
     const claims = st !== null && typeof st === "object" && Object.keys(st).length > 0;
     return claims ? "the receipt records stages but binds the empty-log hash, so no events.jsonl can back it (missing, empty or non-empty); the receipt is forged or was sealed without a log. Re-run the task to produce a fresh receipt" : null;
   }
-  const path = join69(dirname30(receiptPath), "events.jsonl");
-  if (!existsSync46(path))
+  const path = join69(dirname31(receiptPath), "events.jsonl");
+  if (!existsSync47(path))
     return "events.jsonl is missing";
-  const raw2 = readFileSync54(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
+  const raw2 = readFileSync55(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
 `).filter((l) => l.trim() !== "");
   if (events2.length !== lines2.length || events2.some((e, i) => e.seq !== i))
     return "events.jsonl has a forged, edited or missing line";
@@ -16003,7 +16197,7 @@ function checkEventLog(receiptPath, receipt) {
   return h.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join69(dirname30(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
+  const path = join69(dirname31(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
   if (!events2.some((e) => e.type === "receipt.sealed" && e.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -16011,7 +16205,7 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   const seal = events2[done + 1], d = seal?.type === "log.sealed" ? seal.data : null;
   if (!d)
     return { verdict: "TAMPERED", reason: "events.jsonl has no signed log.sealed line after run.completed" };
-  const lines2 = readFileSync54(path, "utf8").split(`
+  const lines2 = readFileSync55(path, "utf8").split(`
 `).filter((l) => l.trim() !== ""), sha4 = createHash18("sha256").update(lines2.slice(0, done + 1).join(`
 `) + `
 `).digest("hex");
@@ -16021,11 +16215,11 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   return null;
 }
 async function verifyReceipt(receiptPath, deps = {}) {
-  if (!existsSync46(receiptPath))
+  if (!existsSync47(receiptPath))
     return { verdict: "UNCHECKED", reasons: [`receipt not found: ${receiptPath}`] };
   let receipt;
   try {
-    receipt = JSON.parse((deps.read ?? ((p) => readFileSync54(p, "utf8")))(receiptPath));
+    receipt = JSON.parse((deps.read ?? ((p) => readFileSync55(p, "utf8")))(receiptPath));
   } catch {
     return { verdict: "UNCHECKED", reasons: ["receipt.json is not valid JSON"] };
   }
@@ -16114,8 +16308,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync48, readFileSync as readFileSync57, statSync as statSync22 } from "fs";
-import { join as join72, resolve as resolve14, sep as sep14 } from "path";
+import { existsSync as existsSync49, readFileSync as readFileSync58, statSync as statSync23 } from "fs";
+import { join as join72, resolve as resolve15, sep as sep15 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -26397,9 +26591,9 @@ function mount20(ctx) {
 }
 
 // src/server/routes/verify.ts
-import { readFileSync as readFileSync55, realpathSync as realpathSync22 } from "fs";
+import { readFileSync as readFileSync56, realpathSync as realpathSync24 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
-import { join as join70, sep as sep13 } from "path";
+import { join as join70, sep as sep14 } from "path";
 init_verify_cmd();
 init_seal();
 init_receipt_dsse();
@@ -26426,15 +26620,15 @@ function mount21(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync22(join70(repo.p, ".loki", "runs"));
-      runDir = realpathSync22(join70(root, run2));
+      const root = realpathSync24(join70(repo.p, ".loki", "runs"));
+      runDir = realpathSync24(join70(root, run2));
       if (runDir !== join70(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync22(join70(runDir, "receipt.json"));
+      file = realpathSync24(join70(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
-    if (!file.startsWith(runDir + sep13))
+    if (!file.startsWith(runDir + sep14))
       return done(404, "receipt not found", "not_found");
     let integrity, reasons, sha4 = null, outcome = "UNREADABLE";
     try {
@@ -26449,7 +26643,7 @@ function mount21(ctx) {
         sha4 = r.receiptSha256 ?? null;
       }
       try {
-        outcome = outcomeOf(JSON.parse(readFileSync55(file, "utf8")));
+        outcome = outcomeOf(JSON.parse(readFileSync56(file, "utf8")));
       } catch {
         outcome = "UNREADABLE";
       }
@@ -26511,7 +26705,7 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 }
 
 // src/server/legacy/shim.ts
-import { existsSync as existsSync47, readFileSync as readFileSync56 } from "fs";
+import { existsSync as existsSync48, readFileSync as readFileSync57 } from "fs";
 import { join as join71 } from "path";
 
 // src/server/legacy/routes.ts
@@ -26892,8 +27086,8 @@ var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
   for (const f of [join71(import.meta.dir, "../../../../../VERSION")]) {
     try {
-      if (existsSync47(f))
-        return readFileSync56(f, "utf8").trim();
+      if (existsSync48(f))
+        return readFileSync57(f, "utf8").trim();
     } catch {}
   }
   return "unknown";
@@ -27075,7 +27269,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join72(import.meta.dir, "../../ui/dist"), join72(import.meta.dir, "../ui/dist")].find((d) => existsSync48(join72(d, "index.html")));
+var defaultUiDir = () => [join72(import.meta.dir, "../../ui/dist"), join72(import.meta.dir, "../ui/dist")].find((d) => existsSync49(join72(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
@@ -27107,7 +27301,7 @@ function createApp(opts) {
     for (const f of [process.env.LOKI_VERSION_FILE, join72(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
-          return readFileSync57(f, "utf8").trim() || "unknown";
+          return readFileSync58(f, "utf8").trim() || "unknown";
       } catch {}
     }
     return "unknown";
@@ -27216,9 +27410,9 @@ function createApp(opts) {
     }
     if (!uiDir || p.startsWith("/v1/"))
       return c.json({ error: "not found" }, 404);
-    const root = resolve14(uiDir);
-    const f = resolve14(root, `.${p}`);
-    if (f.startsWith(root + sep14) && existsSync48(f) && statSync22(f).isFile())
+    const root = resolve15(uiDir);
+    const f = resolve15(root, `.${p}`);
+    if (f.startsWith(root + sep15) && existsSync49(f) && statSync23(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);